Critical SharePoint RCE CVE-2026-50522 Exploited After Public PoC Release

Attackers are exploiting CVE-2026-50522, a critical remote code execution vulnerability in on-premises Microsoft SharePoint Server, according to security researchers monitoring internet attacks. The activity began shortly after public proof-of-concept code appeared.

The flaw allows a remote attacker to send malicious serialized data to a vulnerable SharePoint server and execute code without user interaction. Microsoft assigned the vulnerability a critical CVSS score of 9.8.

watchTowr reported active exploitation against on-premises SharePoint deployments on July 21, 2026. Its honeypot network recorded attackers using the flaw to retrieve SharePoint machine keys, which could help them retain access after administrators install the patch.

What Is CVE-2026-50522?

CVE-2026-50522 affects the way SharePoint processes serialized .NET objects. Deserialization converts stored or transmitted data back into software objects. If an application accepts a malicious object without adequate controls, that object can trigger attacker-selected code.

The CVE-2026-50522 vulnerability record describes a network-accessible, low-complexity flaw that requires no privileges and no user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of the server.

The vulnerability affects supported x64 editions of SharePoint Server that organizations manage themselves. Microsoft has not listed SharePoint Online in Microsoft 365 as an affected product.

Vulnerability detail	Value
CVE	CVE-2026-50522
Product	Microsoft SharePoint Server
Vulnerability type	Deserialization of untrusted data
CWE	CWE-502
CVSS score	9.8 Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None in the published CVSS vector
User interaction	None
Affected service	On-premises SharePoint Server

Researchers See Attacks After Public Exploit Release

Researchers found public proof-of-concept code for CVE-2026-50522 on July 20. watchTowr said its Attacker Eye honeypot network captured successful exploitation attempts within hours.

The observed requests reportedly allowed attackers to retrieve SharePoint machine keys through a single request. SharePoint and the underlying ASP.NET environment use these cryptographic values to protect authentication and application data.

Defused Cyber separately reassessed an undocumented .NET deserialization payload seen against SharePoint sign-in endpoints. The requests contained no authentication information, making CVE-2026-50522 a closer match than the related CVE-2026-58644, which Microsoft has described elsewhere as requiring Site Owner access.

Why Machine-Key Theft Makes Patching Alone Insufficient

Attackers who steal valid machine keys may create trusted authentication or serialized data after administrators patch the original vulnerability. This can give an intruder a path back into the environment unless responders replace the exposed cryptographic material.

Security teams should not rotate machine keys before checking for web shells, credential-stealing tools, scheduled tasks, malicious services, and other persistence. An attacker who remains on the server could capture the replacement keys.

The latest CISA SharePoint hardening alert recommends scanning for and removing intrusion artifacts before rotating IIS machine keys. Organizations should then restart the affected services and monitor for renewed access attempts.

1. Restrict external access to the SharePoint server.
2. Preserve logs, memory, suspicious files, and other evidence.
3. Install the July 2026 SharePoint security update.
4. Verify the update on every server in the farm.
5. Search for web shells and post-exploitation tools.
6. Remove malicious files, accounts, tasks, and persistence.
7. Rotate IIS and ASP.NET machine keys.
8. Reset credentials and tokens accessible from the server.
9. Restart IIS and affected SharePoint services.
10. Monitor for forged sessions and renewed exploitation.

Affected SharePoint Versions and Patched Builds

Microsoft released fixes for CVE-2026-50522 on July 14, 2026. Administrators must patch every SharePoint farm member because one unpatched node can keep the environment exposed.

The Microsoft SharePoint Server 2019 security update includes the fix and raises that product to build 16.0.10417.20175. Microsoft also released corresponding updates for SharePoint Enterprise Server 2016 and SharePoint Server Subscription Edition.

Product	Vulnerable versions	Fixed build
SharePoint Enterprise Server 2016	Earlier than 16.0.5561.1001	16.0.5561.1001 or later
SharePoint Server 2019	Earlier than 16.0.10417.20175	16.0.10417.20175 or later
SharePoint Server Subscription Edition	Earlier than 16.0.19725.20434	16.0.19725.20434 or later

Administrators should confirm the installed build rather than relying only on a successful update download. They should also complete any required SharePoint configuration steps and check the update status across the entire farm.

CVE-2026-50522 and CVE-2026-58644 Are Related but Distinct

Microsoft patched CVE-2026-50522 and CVE-2026-58644 during the same July update cycle. Both involve unsafe deserialization in SharePoint and carry CVSS scores of 9.8.

The Zero Day Initiative’s July patch analysis describes the vulnerabilities as a matching pair. ZDI also notes that researchers demonstrated CVE-2026-50522 at Pwn2Own Berlin and provided Microsoft with a working exploit before the patch release.

Microsoft’s public material has created some uncertainty around authentication. The CVSS vectors for both vulnerabilities list no privileges, while explanatory text associated with CVE-2026-58644 has described an attacker with Site Owner access. Organizations should treat any reachable, unpatched server as high risk while technical details remain limited.

CVE	Severity	Exploitation status on July 22	Official CISA KEV status
CVE-2026-50522	9.8 Critical	Active exploitation reported by watchTowr and Defused Cyber	Not listed at the time of publication
CVE-2026-58644	9.8 Critical	Microsoft and CISA confirm exploitation	Added July 16, 2026

What Attackers Can Do After Exploiting SharePoint

Remote code execution can give an attacker control within the security context of the SharePoint application. From there, the intruder may access sensitive documents, configuration data, application credentials, and connected systems.

Attackers can also install web shells, create persistence, steal machine keys, modify SharePoint content, or use the server as a foothold for lateral movement. SharePoint servers often connect to Active Directory, SQL Server, backup systems, file shares, and internal applications.

• Execute commands on the SharePoint server
• Read or modify stored documents
• Steal configuration and application secrets
• Retrieve IIS and ASP.NET machine keys
• Deploy web shells or additional malware
• Create persistent access
• Move laterally into connected systems
• Use the server to target administrator accounts
• Disrupt SharePoint services and business operations

How to Detect CVE-2026-50522 Exploitation

Defenders should review SharePoint, IIS, Windows, endpoint, identity, and network telemetry together. A single web request may provide the initial entry point, while later activity can appear under trusted SharePoint or IIS processes.

Monitoring should focus on unusual unauthenticated requests to SharePoint sign-in and application endpoints, especially requests containing serialized .NET data. Teams should also investigate unexpected child processes, file writes, key access, and outbound connections from SharePoint worker processes.

Data source	Activity to investigate
IIS logs	Unusual unauthenticated POST requests to SharePoint endpoints
SharePoint logs	Deserialization errors, unexpected requests, and abnormal application activity
Process telemetry	w3wp.exe spawning command shells, PowerShell, script engines, or utilities
File monitoring	New ASPX files, DLLs, scripts, or executables in web-accessible directories
Registry and services	Unexpected autostart entries, scheduled tasks, or newly installed services
Credential telemetry	Access to machine keys, service credentials, or configuration secrets
Network telemetry	Unexpected outbound traffic from SharePoint and IIS processes
Identity logs	New administrator sessions, forged authentication, or activity from unusual locations

Immediate Actions for SharePoint Administrators

Organizations should handle CVE-2026-50522 as an emergency issue, especially when an affected SharePoint server accepts connections from the internet. Removing direct exposure can reduce immediate risk while administrators complete patching and investigation.

The CISA guidance recommends installing supported updates, confirming successful deployment, enabling Antimalware Scan Interface integration, scanning for compromise, and rotating machine keys after responders remove malicious artifacts.

• Inventory every on-premises SharePoint server and farm member.
• Identify internet-facing systems and restrict access immediately.
• Install the July 2026 security update on all farm members.
• Confirm that each server meets or exceeds the fixed build.
• Enable AMSI for every SharePoint web application.
• Deploy current endpoint protection and behavioral monitoring.
• Search for web shells, suspicious DLLs, and unexpected processes.
• Review IIS, SharePoint, Windows, identity, and network logs.
• Rotate machine keys only after removing active persistence.
• Reset exposed service, administrator, database, and application credentials.
• Retire unsupported SharePoint installations that cannot receive security updates.

Administrators running SharePoint Server 2019 can obtain the fix through the July 2026 Microsoft security update. Teams should use the equivalent Microsoft update for their installed SharePoint edition and verify that dependent components meet Microsoft’s prerequisites.

Official Exploitation Status May Change

Microsoft initially classified CVE-2026-50522 as “exploitation more likely” rather than “exploitation detected.” CISA had not added it to the Known Exploited Vulnerabilities catalog by July 22.

That official status does not invalidate the honeypot evidence. watchTowr’s exploitation alert says attackers successfully used the public proof of concept and retrieved SharePoint machine keys from target systems.

Organizations should not wait for another advisory or KEV entry. The combination of unauthenticated network access, low attack complexity, public exploit code, and reported exploitation makes immediate remediation necessary.

Key Facts for Defenders

• CVE-2026-50522 affects supported on-premises SharePoint Server editions.
• The flaw has a CVSS score of 9.8.
• The published CVSS vector lists no privileges or user interaction.
• Microsoft released fixes on July 14, 2026.
• Researchers reported active exploitation after public exploit code appeared.
• Observed attackers retrieved SharePoint machine keys.
• Patching does not remove malware or invalidate previously stolen keys.
• SharePoint Online does not appear in the affected-product list.
• CISA has listed CVE-2026-58644, but not CVE-2026-50522, in KEV at the time of publication.

The authoritative CVE-2026-50522 record provides the affected products, vulnerable build ranges, CVSS vector, and links to Microsoft’s security material.

The Zero Day Initiative review also confirms that researchers had a working CVE-2026-50522 exploit before Microsoft released the July fixes. That history, combined with current attack reports, supports an emergency patching and incident-response priority.

FAQ